Apple WebKit Cross-Origin Data Exfiltration Vulnerability

A vulnerability in WebKit's cookie management allows cross-origin data exfiltration. This issue affects multiple Apple operating systems, including watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18, iPadOS 18, and tvOS 18. The vulnerability arises from inadequate state management, which a malicious website could exploit to access sensitive information across different origins.

Impact

Exploitation of this vulnerability could lead to unauthorized access and exfiltration of user data from one origin to another, potentially allowing malicious websites to access sensitive information that should be protected by the same-origin policy.

Remediation

Users can update to the latest versions of watchOS, macOS, Safari, visionOS, iOS, iPadOS, and tvOS to address this vulnerability. Instructions for updating can be found on the Apple Support website.